In an ongoing investigation through Snowflake's HackerOne vulnerability disclosure initiative, Wiz Research's autonomous AI security tool, named "Red Agent," uncovered a significant vulnerability in the GitHub Actions workflow of one of Snowflake's public repositories. This incident underscores a crucial aspect of modern software development: vulnerabilities can be introduced and approved within AI-driven coding workflows and evade established automated security protocols, while AI security agents can swiftly discover and exploit these weaknesses.
Following responsible disclosure on June 23, 2026, by Wiz, Snowflake addressed the vulnerability on the same day, rotating the compromised credentials and confirming through meticulous audits that Wiz was the only entity involved during the exposure period. Wiz also assured that all data accessed during their proof-of-concept testing was deleted securely.
An update on August 17, 2026, clarified that GitHub's Copilot played a role in reviewing the merged pull request (PR) and failed to identify the critical vulnerabilities. It remains uncertain if the code change was AI-assisted.
In summary, Wiz Red Agent identified a script injection flaw within the snowflakedb/snowflake-connector-net repository. The issue enabled an unauthorized user to execute arbitrary commands in a GitHub Actions runner by submitting a cleverly crafted GitHub issue title.
The vulnerability went live on June 18, 2026, just days before its discovery, following the merge of PR #1218. A GitHub Advanced Security scan assessed the final PR version, including the problematic workflow, yet did not flag the significant injection risk.
The Red Agent's capabilities enabled it to scan Snowflake’s GitHub organization and identify the jira_issue.yml Workflow as vulnerable to script injection due to untrusted inputs in the run: blocks.
Details of the Code Change:
- Environment variable: - ISSUE_TITLE : ${{ github.event.issue.title }} - Run function: - run : jq -n --arg title "$ISSUE_TITLE" ...
This workflow, triggered by new issues, allowed any GitHub user to initiate it by simply opening an issue, interpolating the attacker-controlled issue title into a shell script.
The vulnerability emerged with the merging of commit 094038e, which went live with PR #1218. GitHub’s Advanced Security's scrutiny captured the vulnerable jira_issue.yml workflow but failed to identify the script injection weakness. The merged alteration replaced essential safe patterns in the environment variable and jq with direct interpolation of ${{ github.event.issue.title }}, thus opening an injection vector.
The workflow included a seemingly protective if-condition that, in reality, was ineffective. Since github.event.pull_request was always null during issue events, the security gate condition was always true and allowed every GitHub user to bypass it.
Exploitation Occurred When:
Wiz crafted a malicious issue title that ultimately broke the string and exfiltrated Jira credentials through an out-of-band callback. The initial payload attempt faced a bash syntax error due to the use of a comment character. Red Agent autonomously adapted the payload, employing syntax adjustments to successfully achieve the exfiltration of sensitive data.
The exploit resulted in a callback from a GitHub Actions runner, revealing base64-encoded credentials linked to a specific Snowflake account, providing access to sensitive areas of their projects.
**Remediation Measures:** - On June 23, 2026, Snowflake rectified the workflow (commit 1dc7766, PR #1402) by reinstating the safe environment variable and jq parsing approach. - The compromised JIRA token was revoked and rotated. - A thorough audit confirmed no unauthorized access occurred during the five-day window of exposure, attributing all activity to Wiz's testing IP.
**Key Insights:** 1. **Vigilance in AI Code Generation:** AI coding tools can inadvertently introduce deprecated patterns; thus, any AI-generated pull requests should be subjected to rigorous security scrutiny akin to that of human-written code. 2. **Rapid Discovery Necessitates Swift Response:** The vulnerability was active for only five days before discovery, demanding that security operations adapt with faster patch cycles and shorter credential lifetimes to keep pace with automated discovery tools. 3. **Maintaining CI/CD Security Integrity:** Safety protocols must be explicitly enforced to prevent regressions in security design. In this case, a safe coding practice was replaced without appropriate checks, resulting in the exposure that transpired.
**Timeline of Events:** - **June 18, 2026:** The vulnerability became active upon the merge of PR #1218. - **June 23, 2026:** Wiz reported the vulnerability through HackerOne (report #3819931). - **June 23, 2026:** Notification sent to Snowflake’s security team. - **June 23, 2026:** Snowflake promptly patched the vulnerability (commit 1dc7766, PR #1402). - **June 24, 2026:** Rotation of the JIRA token took place. - **July 25, 2026:** Public disclosure deadline, as per Snowflake’s disclosure guidelines.
This incident illustrates the evolving landscape of software development and the critical need for vigilance and robust security practices in an era increasingly influenced by AI technologies.
